was the issue with mssql jdbc in the previous hotfix figured out?

Hi @Cory Howitz This issue has been fixed in this update - https://tracker.adobe.com/#/view/CF-4219940

so its fixed but then the searchimplicitscope thing comes into play, out of the frying pan....

We understand this a major change and could potentially break existing code. That being said, this fix was necessary and we have also provided 2 ways in which you can revert this change temporarily 1) You can add the newly introduced flag, -Dcoldfusion.searchimplicitscopes=true to the jvm arguments or 2) You can set searchimplicitscopes key to TRUE in Application.cfc or Application.cfm, in which case it will override the jvm flag set at the server level.

@Megha Is there documentation of exactly what scopes are considered "implicit"?

Hi @Dave Merrill Yes, we have updated this information in the technote

Great, I'll check it out. Thank you 🙂

https://helpx.adobe.com/coldfusion/kb/coldfusion-2023-update-7.html Here we have added the list of scopes affected by the change and also some simple examples.

Arg, my bad, it's in the 2021 U13 release notes too 🙃

@Megha the scope example in the CF2021 technote is missing the initial code example. It does exist in the CF2023 technote.

@Jim Priest Will have this updated, thanks for pointing it out

@Megha Looking at the technote and at https://helpx.adobe.com/coldfusion/developing-applications/the-cfml-programming-language/using-coldfusion-variables/about-scopes.html is it correct to interpret the combination of these two references in the following manner: with

searchImplicitScopes = false

, unscoped variables will still be found in local, arguments, thread-local, query, thread, and variables scopes but will not be found CGI, cffile, URL, form, cookie, and client?

@rstewart Correctly interpreted. CGI, cffile, URL, form, cookie, and client are the scopes for which input is expected from application users directly. Hence they can be easily manipulated. Other scopes are not very directly exposed to application users.

Thanks, @Satyam Mishra. Just wanted to be sure I was looking at that correctly. I've started wading through one of our older applications where this is much more likely to be an issue.